CVE-2022-29072

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process. NOTE: multiple third parties have reported that no privilege escalation can occur

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/166763/7-Zip-21.07-Code-Execution-Privilege-Escalation.htmlBroken Link
https://github.com/kagancapar/CVE-2022-29072Exploit, Third Party Advisory
https://news.ycombinator.com/item?id=31070256Issue Tracking, Third Party Advisory
https://sourceforge.net/p/sevenzip/bugs/2337/Exploit, Issue Tracking, Third Party Advisory
https://www.youtube.com/watch?v=sT1cvbu7ZTAExploit, Third Party Advisory
http://packetstormsecurity.com/files/166763/7-Zip-21.07-Code-Execution-Privilege-Escalation.htmlBroken Link
https://github.com/kagancapar/CVE-2022-29072Exploit, Third Party Advisory
https://news.ycombinator.com/item?id=31070256Issue Tracking, Third Party Advisory
https://sourceforge.net/p/sevenzip/bugs/2337/Exploit, Issue Tracking, Third Party Advisory
https://www.youtube.com/watch?v=sT1cvbu7ZTAExploit, Third Party Advisory

Timeline

Published: Apr 15, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-290779.8A heap-based buffer overflow exists in rippled before 1.8.5. The vulnerability allows attackers to cause a crash or execute commands remotel CVE-2022-290789.8The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][output CVE-2022-29084.3A potential DoS vulnerability was discovered in Gitlab CE/EE versions starting from 10.7 before 15.1.5, all versions starting from 15.2 befo CVE-2022-290809.8The npm-dependency-versions package through 0.3.0 for Node.js allows command injection if an attacker is able to call dependencyVersions wit CVE-2022-290819.8Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-contro CVE-2022-290824.6Dell EMC NetWorker versions 19.1.x, 19.1.0.x, 19.1.1.x, 19.2.x, 19.2.0.x, 19.2.1.x 19.3.x, 19.3.0.x, 19.4.x, 19.4.0.x, 19.5.x,19.5.0.x, 19.6 CVE-2022-290836.8Prior Dell BIOS versions contain an Improper Authentication vulnerability. An unauthenticated attacker with physical access to the system co CVE-2022-290849.8Dell Unity, Dell UnityVSA, and Dell Unity XT versions before 5.2.0.0.5.173 do not restrict excessive authentication attempts in Unisphere GU CVE-2022-290856.7Dell Unity, Dell UnityVSA, and Dell Unity XT versions prior to 5.2.0.0.5.173 contain a plain-text password storage vulnerability when certai CVE-2022-290894.9Dell Networking OS10, versions prior to October 2021 with Smart Fabric Services enabled, contains an information disclosure vulnerability. A CVE-2022-29098.8A vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script. It has been declared as critical. Affected by this vulnera CVE-2022-290906.5Dell Wyse Management Suite 3.6.1 and below contains a Sensitive Data Exposure vulnerability. A low privileged malicious user could potential